[SENTRY-1209] Sentry does not block Hive's cross-schema table renames

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.5.1
• Fix Version/s: 1.8.0
• Component/s: Core, Hive Binding, Hive Plugin, Sentry
• Labels: security

Environment

CDH 5.5.2

• Assignee: Colin
• Reporter: Ruslan Dautkhanov
• Created: 19/Apr/16 22:55
• Updated: 22/May/18 16:22
• Resolved: 15/Jul/16 01:55

Description

User Pete
has read-write access to schema A
has read-only access to schema B

User Pete nevertheless was able to rename/move Hive table
from schema A to schema B (where he has read-only access):

use A;
alter table table_a rename to B.table_a;

Hive allows to use rename table syntax to move tables across schemas, not just rename.

Sentry does not check security boundaries in this case.

Issue Links

• is related to: SENTRY-2066 DB name is not set for AlterTable
• links to: Review board